Setup WireGuard Site to Site VPN Tunnel on pfsense 2.7.2

This guide was inspired by Marcus Rath

Introduction

This guide will walk you through setting up a WireGuard site to site  VPN tunnel on pfsense 2.7.2. For this guide we assume Site A with a network subnet of 192.168.1.0/24, Site B with a network subnet of 192.168.24.0/24 and a Tunnel Subnet of 10.10.12.0/30. Obviously adjust these settings to your specific needs.

Ensure that the Tunnel Subnet you choose does NOT overlap with any other network subnets currently in use in your network environment.

Install WireGuard Package on Both Sites

On BOTH site pfsense installations, install the WireGuard package from System ---> Package Manager ---> Available Packages. Enter Wireguard in the Search term field, click search and then click on the Install button next to WireGuard package (Figure  1).

Figure 1

image.png

Create Tunnel on Site A

On Site A, refresh the pfsense web GUI and navigate to VPN ---> Wireguard, click on the Tunnels tab and then click on Add Tunnel button (Figure 2).

Figure 2

image.png

In the Tunnel Configuration fill/set in the following fields (Figure 3):

Figure 3

image.png

Create Tunnel on Site B

On Site B, refresh the pfsense web GUI and navigate to VPN ---> Wireguard, click on the Tunnels tab and then click on Add Tunnel button (Figure 4).

Figure 4

image.png

In the Tunnel Configuration fill/set in the following fields (Figure 5):

Figure 5

image.png

Enable WireGuard on Both Sites

On BOTH sites, navigate to VPN ---> WireGuard, click on the Settings tab and click on the Enable WireGuard checkbox, select Only Unassigned Tunnels on the Interface Group Membership drop-down and then click on the Save button (Figure 6).

Figure 6

image.png

Add Peer on Site A

On Site A, navigate to VPN ---> WireGuard, click on the Peers tab and then click on the Add Peer button (Figure 7).

Figure 7

image.png

In the Peer Configuration fill/set in the following fields (Figure 8):

Figure 8

image.png

Add Peer on Site B

On Site B, navigate to VPN ---> WireGuard, click on the Peers tab and then click on the Add Peer button (Figure 9).

Figure 9

image.png

In the Peer Configuration fill/set in the following fields (Figure 10):

Figure 10

image.png

Configure Interface for Site A

On Site A, navigate to Interfaces ---> Assignments and under Available network ports drop-down select the WireGuard tunnel you previously created and click the Add button (Figure 11).

Figure 11

image.png

Click on the new OPT(X) interface that was just created (Figure 12).

Figure 12

image.png

In the General Configuration page fill/set the following fields (Figure 13):

Figure 13

image.png

Configure Interface for Site B

On Site B, navigate to Interfaces ---> Assignments and under Available network ports drop-down select the WireGuard tunnel you previously created and click the Add button (Figure 14).

Figure 14

image.png

Click on the new OPT(X) interface that was just created (Figure 15).

Figure 15

image.png

In the General Configuration page fill/set the following fields (Figure 16):

Figure 16

image.png

Create Gateway and Route on Site A

On Site A navigate to System ---> Routing and under the Gateways tab click the Add button (Figure 17).

Figure 17

image.png

In the Edit Gateway page fill/set the following fields (Figure 18):

Figure 18

image.png

Next, on Site A navigate to System ---> Routing and under the Static Routes tab click the Add button (Figure 19).

Figure 19

image.png

In the Edit Route Entry page, fill/set the following fields (Figure 20):

Figure 20

image.png

Create Gateway and Route on Site B

On Site B navigate to System ---> Routing and under the Gateways tab click the Add button (Figure 21).

Figure 21

image.png

In the Edit Gateway page fill/set the following fields (Figure 22):

Figure 22

image.png

Next, on Site B navigate to System ---> Routing and under the Static Routes tab click the Add button (Figure 23).

Figure 23

image.png

In the Edit Route Entry page, fill/set the following fields (Figure 24):

Figure 24

image.png

Add Firewall Rules on BOTH Firewalls

On BOTH firewalls, navigate to Firewall ---> Rules and under the WAN tab, click the Add button. In the Edit Firewall Rule page, fill/set the following fields (Figure 25).

Figure 25

image.png

On BOTH firewalls, navigate to Firewall ---> Rules and under the TUNNELTOSITE(X) tab, click the Add button. In the Edit Firewall Rule page, fill/set the following fields (Figure 25).

Figure 25

image.png

Check the Wireguard Status

On BOTH firewalls navigate to Status ---> Wireguard, locate the WireGuard tunnel you created, expand it and ensure the Peers are connected on BOTH firewalls (Figure 26).

Figure 26

image.png

Additionally, ensure you can ping and access resources on each remote network from the corresponding site.


Revision #16
Created 18 January 2024 18:26:24 by Dino Edwards
Updated 20 January 2024 14:50:10 by Dino Edwards